Description

This curriculum spans the full lifecycle of threat hunting operations, comparable in scope to a multi-workshop program that integrates with existing SOC workflows, addresses cross-functional coordination challenges, and aligns technical execution to organizational risk priorities.

Module 1: Establishing Threat Hunting Objectives and Scope

Define hunting hypotheses based on organization-specific threat intelligence, such as targeting known adversary TTPs from recent ransomware campaigns affecting the sector.
Negotiate access levels with network and system owners to ensure visibility into critical assets without disrupting production workloads.
Select high-value targets for initial hunts, including domain controllers, cloud identity providers, and database servers with sensitive data.
Balance proactive hunting efforts against reactive incident response demands during resource-constrained periods.
Determine whether to prioritize IOCs from external feeds or internally derived anomalies based on detection gap analysis.
Document and justify scope exclusions, such as OT environments or third-party managed systems, to manage stakeholder expectations.

Module 2: Integrating and Normalizing Data Sources

Map available telemetry sources (EDR, firewall logs, DNS, authentication logs) to MITRE ATT&CK techniques for coverage assessment.
Resolve schema mismatches between legacy syslog systems and modern SIEM platforms during log ingestion.
Configure log retention policies that support long-term hunting while complying with storage budgets and privacy regulations.
Implement parser adjustments to handle inconsistent timestamp formats from multi-vendor devices.
Validate completeness of EDR data collection by comparing process execution logs with scheduled task configurations.
Address gaps in cloud workload visibility by enabling AWS CloudTrail, Azure Monitor, or GCP Audit Logs across all production projects.

Module 3: Developing and Prioritizing Hunting Hypotheses

Convert IOAs from recent threat reports into executable queries, such as detecting PsExec usage outside of maintenance windows.
Adjust hypothesis priority based on current threat landscape, such as increasing focus on log4j exploitation during active scanning waves.
Correlate internal anomaly trends (e.g., spike in failed logins) with external threat actor patterns to refine hypothesis specificity.
Decide whether to pursue low-frequency, high-impact hypotheses (e.g., APT lateral movement) versus high-frequency, noisy ones (e.g., brute force).
Validate assumptions in hypotheses by reviewing false positive rates from previous hunts using similar logic.
Coordinate with red team findings to identify detection blind spots requiring hypothesis-driven validation.

Module 4: Executing Structured Hunting Campaigns

Construct time-bound hunting runs with defined start and end criteria to prevent open-ended investigations.
Use Sigma rules to standardize detection logic across multiple SIEM environments during cross-organization hunts.
Apply statistical baselining to distinguish anomalous behavior, such as deviations in off-hour authentication volume.
Chain multiple data sources (e.g., DNS lookups followed by process execution) to reduce false positives in lateral movement detection.
Document query performance impact and optimize search logic to avoid SIEM resource exhaustion during large-scale scans.
Isolate and preserve raw logs from systems of interest when initial indicators suggest ongoing compromise.

Module 5: Validating and Triage of Hunting Findings

Classify findings using a standardized severity matrix that incorporates exploitability, asset criticality, and evidence confidence.
Escalate confirmed malicious activity to incident response with full context, including affected hosts and observed TTPs.
Distinguish between true positives and acceptable risks, such as legacy systems with known vulnerabilities under compensating controls.
Update detection rules in EDR and SIEM based on newly identified adversary behaviors from hunt results.
Conduct peer review of findings to reduce confirmation bias in hypothesis validation.
Archive non-malicious anomalies for trend analysis, such as scheduled backup tools mimicking credential dumping.

Module 6: Automating and Scaling Hunting Workflows

Develop scheduled Jupyter notebooks to automate repetitive queries, such as checking for suspicious PowerShell command-line arguments.
Integrate hunting tools with SOAR platforms to auto-collect host artifacts when specific indicators are observed.
Implement feedback loops where automated detections trigger new hypothesis generation based on behavioral clustering.
Standardize output formats for hunting reports to enable comparison across time and analysts.
Use threat intelligence platforms to auto-enrich IOCs identified during hunts with attribution and context.
Balance automation coverage against maintenance overhead, retiring scripts that no longer yield actionable results.

Module 7: Measuring Hunting Efficacy and Reporting

Track mean time to detect (MTTD) for threats identified via hunting versus traditional alerts to demonstrate value.
Calculate hypothesis success rate by measuring percentage of hunts yielding actionable findings.
Report on detection gaps closed by hunting, such as new coverage for T1059 (Command and Scripting Interpreter).
Present findings to executive stakeholders using business-aligned metrics, such as reduction in dwell time.
Compare hunting output against ATT&CK coverage heatmaps to identify under-explored technique categories.
Revise hunting cadence and resource allocation based on quarterly performance reviews and incident post-mortems.

Module 8: Governance and Cross-Functional Alignment

Establish formal review cycles with CISO and audit teams to validate hunting activities meet compliance requirements.
Coordinate with network teams to obtain packet captures during active hunts without violating data privacy policies.
Define data handling procedures for sensitive artifacts collected during hunts, including encryption and access controls.
Negotiate change windows for deploying new EDR sensors or log forwarders required for expanded visibility.
Align hunting priorities with business initiatives, such as increased focus during cloud migration projects.
Participate in tabletop exercises to test integration between hunting findings and incident response playbooks.